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(57) When content data is encrypted and recorded, 
the content data is block-segmented and chain-encrypt- 
ed. At that point, an initial value is generated using con- 
tent data of the same sector. When content data is an 
MPEG stream, an initial value is generated using unique 
information such as a header. Thus, it is not necessary 



to generate an initial value using a random number or 
the like. Thus, there is no loss in the data area. In addi- 
tion, since content data varies at random, the secrecy 
of the initial value is high. In addition, since it is not nec- 
essary to provide a random number generator or the 
like, the circuit scale does not increase. 
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Description 

Technical Field 

[0001] The present invention relates to an encrypting 
apparatus, an encrypting method, a decrypting appara- 
tus, a decrypting method, and a storage medium that 
are suitable for encrypting content data such as audio 
data and recording the encrypted data to an optical disc 
such as a CD (Compact Disc) 2 so as to protect the right 
of the content data when it is recorded to and repro- 
duced from the optical disc. 

Background Art 

[0002] In recent years, optical discs as large capacity 
record mediums have been developed. For example, 
CD (Compact Disc) for music information, CD-ROM 
(Compact Disc Read Only Memory) for computer data, 
and DVD (Digital Versatile Disc or Digital Video Disc) for 
video information are known. 

[0003] These optical discs are read-only discs. In re- 
cent years, optical discs that allow data to be recorded 
and rewritten such as CD-R (CD-Recordable) disc and 
CD-RW (CD-Rewritable) disc have been commercially 
used. In addition, various types of optical discs such as 
double density CD and CD2 are being developed. The 
double density CD has the same size as conventional 
CD, but more storage capacity than that. The CD2 has 
an affinity to both a conventional CD player and a per- 
sonal computer. 

[0004] As such optical discs are becoming common, 
content data recorded on an optical disc may be illegally 
copied and used. Alternatively, a copied disc may be il- 
legally sold. As a result, there is a risk of which the cop- 
yright owner will suffer a loss from that. To solve such a 
problem, when content data such as audio data and vid- 
eo data are recorded on optical discs, content data is 
encrypted so as to protect the right of the copyright own- 
er. 

[0005] As encrypting systems that are used when 
content data is recorded on optical discs, block encrypt- 
ing systems such as DES (Data Encryption Standard) 
and tipple DES have been used. The DES is a typical 
common key encrypting system. In the DES, data of 64 
bits is initially transposed (scrambled). Data of blocks 
each of which is composed of 32 bits is successively 
nonlinearly processed using 16 keys each of which is 
composed of one encryption key of 56 bits. The proc- 
essed result is transposed once again and thereby en- 
crypted data is obtained. 

[0006] However, since the length of each block of the 
block encrypting system such as DES is relatively short, 
there is a possibility of which similar blocks often take 
place. Thus, this system has a problem with respect an 
encrypting strength. 

[0007] To improve the encrypting strength, it has been 
considered to use CBC (Ciphering Block Chaining) sys- 



tem. In the CBC system, encrypted blocks of data are 
chained so as to improve the encrypting strength. 
[0008] In other words, in the CBC system, data of a 
current input block and data of which data of the imme- 
5 diately preceding block was encrypted are ex-ORed and 
encrypted. When encrypted data is decrypted, data of 
an encrypted block decrypted. The decrypted data and 
the data of the immediately preceded encrypted block 
are ex-ORed. As a result, the data of the original block 
10 js obtained. In the CBC system, when data is encrypted, 
data of the current block is chained with data of the im- 
mediately preceding encrypted block data. Thus, the en- 
crypting strength can be improved. 
[0009] In such a manner, when data of a content is 
15 recorded on an optical disc corresponding to the CBC 
system, the encrypting strength is improved. As a result, 
the copyright can be more strongly protected. However, 
according to the CBC system, when data of the current 
block is changed with data of the immediately preceding 
encrypted block, data of the first block is encrypted, 
there is no data of the immediately preceding block, it is 
necessary to prepare an initial value. As an initial value 
for an encrypting process corresponding to the CBC 
system, a fixed value can be used as the simplest meth- 
od. However, when a fixed value is used to perform an 
encrypting process corresponding to the CBC system, 
a problem with respect to secrecy takes place. Thus, 
even if the CBC system is used, a high encrypting 
strength cannot be maintained. In addition, to provide a 
fixed value as an initial value, it is necessary to store the 
fixed value somewhere. 

[0010] Thus, it can be considered that an initial value 
is generated using data in another area contained in an 
encrypted block. Such data includes for example error 
correcting ECC (Error Correcting Code) and medium in- 
formation. These data is not copyrighted data. Thus, it 
is not necessary to protect such data. Normally, they are 
not contained in an encrypted block. Thus, it is consid- 
ered that an initial value is generated using data of an- 
other area such as ECC or medium information. 
[0011] Fig. 25 shows an example of which an initial 
value used for an encrypting process corresponding to 
the CBC system is generated using data of another area 
such as ECC or medium information. As shown in Fig. 
25, input block data Di is 256 blocks of data that are 
block 0 to block 255. Each block is composed of eight 
bytes (64 bits). 

[0012] First of all, as an initial value inV, data is input 
from another area. An ex-OR gate 501 ex-ORes the in- 
put block data DO and the initial value inV. A block en- 
crypting circuit 502 encrypts the output of the ex-OR 
gate 501 using the key information K and generates en- 
crypted block data EDO. 

[0013] Thereafter, the ex-OR gate 501 ex-ORes the 
input block data D1 and the immediately preceding en- 
crypted block data EDO. The block encrypting circuit 1 02 
encrypts the output of the ex-OR gate 501 using the key 
information K and generates encrypted block data ED1 . 
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[0014] In the same manner, the input block data Di 
and the immediately preceding encrypted block data 
EDi-1 are ex-ORed. The block encrypting circuit 502 en- 
crypts the output of the ex-OR gate 501 using the key 
information K and generates encrypted block data EDi. 
[0015] Thus, when the initial value inV is generated 
using data of other than blocks (for example, ECC or 
medium information), since the initial value is not a fixed 
value, the secrecy is improved. 

[0016] However, the initial value inV is generated us- 
ing data of other than blocks (for example, ECC or me- 
dium information), data other than data of a content is 
always required to perform the encrypting process. 
Thus, it is impossible to encrypt only data of a content 
and transmit the encrypted data. As a result, when data 
of a content is transmitted, it is necessary to transmit 
ECC or medium information along with the data of the 
content. 

[0017] As another method for generating an initial val- 
ue necessary for an encrypting process corresponding 
to the CBC system, it can be considered that the initial 
value is generated using a random number. 
[0018] In other words, as shown in Fig. 26, first of all, 
a value generated using a random number is placed as 
an initial value to block data DO. 
[0019] A block encrypting circuit 512 encrypts the 
block data DO to which the initial value was placed using 
the key information K and generates encrypted block 
data ED1. 

[0020] Thereafter, an ex-OR gate 511 ex-ORes input 
block data D1 and the immediately preceding encrypted 
block data EDO. The block encrypting circuit 512 en- 
crypts the output of the ex-OR gate 511 using the key 
information K and generates the encrypted block data 
ED1. 

[0021] In the same manner, the input block data Di 
and the immediately preceding encrypted block data 
EDi-1 are ex-ORed. The block encrypting circuit 51 2 en- 
crypts the output of the ex-OR gate 511 using the key 
information K and generates encrypted block data EDi. 
[0022] However, when an initial value is generated us- 
ing a random number, the initial value generated using 
the random number is placed to the block data DO. Thus, 
data of a content cannot be placed to the block data DO. 
As a result, data of a content can be placed to only 2040 
bytes of 256 blocks (2048) bytes of blocks 0 to 255 of 
one sector. Consequently, the data area cannot be ef- 
fectively used. 

[0023] In addition, to generate an initial value using a 
random number, a random number generating circuit is 
required. To improve the secrecy, it is necessary to gen- 
erate a random code as a random number. However, 
when such a random number generating circuit is dis- 
posed, the circuit scale adversely increases. 
[0024] Therefore, an object of the present invention is 
to provide an encrypting apparatus, an encrypting meth- 
od, a decrypting apparatus, a decrypting method, and a 
storage medium that do not require data of a special ar- 



ea or a random number for an initial value necessary for 
a chain-encrypting process and that allow the secrecy 
of data to be improved. 

[0025] Another object of the present invention is to 
5 provide an encrypting apparatus, an encrypting method, 
a decrypting apparatus, a decrypting method, and a 
storage medium that allow the data area to be effectively 
used when a chain-encrypting process is performed. 

10 Disclosure of the Invention 

[0026] The present invention is an encrypting appa- 
ratus, comprising a generating means for generating an 
initial value using data of a first portion of content data, 
15 and an encrypting means for encrypting data of a sec- 
ond portion of the content data using the generated in- 
itial value, outputting the encrypted data, and chain-en- 
crypting data of portions other than the first portion and 
the second portion of the content data using the output 
encrypted data. 

[0027] The present invention is an encrypting method, 
comprising the steps of generating an initial value using 
data of a first portion of content data, and encrypting 
data of a second portion of the content data using the 
generated initial value, outputting the encrypted data, 
and chain-encrypting data of portions other than the first 
portion and the second portion of the content data using 
the output encrypted data. 

[0028] The present invention is a decrypting appara- 
tus, comprising a decrypting means for decrypting data 
of a second portion of encrypted content data using an 
initial value that is data of a first portion of the encrypted 
content data, outputting the decrypted data, and chain- 
decrypting data of portions other than the first portion 
and the second portion using the data of the second por- 
tion of the encrypted content data, and a generating 
means for generating the data of the first portion using 
the data of the first portion of the encrypted content data. 
[0029] The present invention is a decrypting method, 
comprising the steps of decrypting data of a second por- 
tion of encrypted content data using an initial value that 
is data of a first portion of the encrypted content data 
and outputting the decrypted data, chain-decrypting da- 
ta of portions other than the first portion and the second 
portion using the data of the second portion of the en- 
crypted content data, and generating the data of the first 
portion using the data of the first portion of the encrypted 
content data. 

[0030] The present invention is a storage medium for 
storing data encrypted corresponding to an encrypting 
method, comprising the steps of generating an initial val- 
ue using data of a first portion of content data, and en- 
crypting data of a second portion of the content data us- 
ing the generated initial value, outputting the encrypted 
data, and chain-encrypting data of portions other than 
the first portion and the second portion of the content 
data using the output encrypted data. 
[0031] The present invention is an encrypting appa- 
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ratus, comprising a generating means for generating an 
initial value using data of a predetermined portion of a 
stream of content data, and an encrypting means for en- 
crypting the content data using the generated initial val- 
ue, outputting the encrypted data, and chain-encrypting 
data of other portions of the content data using the out- 
put encrypted data. 

[0032] The present invention is an encrypting method, 
comprising the steps of generating an initial value using 
data of a predetermined portion of a stream of content 
data, and encrypting the content data using the gener- 
ated initial value, outputting the encrypted data, and 
chain-encrypting data of other portions of the content 
data using the output encrypted data. 
[0033] The present invention is a decrypting appara- 
tus, comprising a generating means for generating an 
initial value using data of a predetermined portion of a 
stream of content data, and a decrypting means for de- 
crypting data of a first portion of encrypted content data 
using the initial value, outputting the decrypted data, and 
chain-decrypting data of a second portion that is differ- 
ent from the first portion using the data of the first portion 
of the encrypted content data. 

[0034] The present invention is a decrypting method, 
comprising the steps of generating an initial value using 
data of a predetermined portion of a stream of content 
data, and decrypting data of a first portion of encrypted 
content data using the initial value and outputting the 
decrypted data, and chain-decrypting data of a second 
portion that is different from the first portion using the 
data of the first portion of the encrypted content data. 
[0035] The present invention is a storage medium for 
storing data decrypted corresponding to a decrypting 
method, comprising the steps of generating an initial val- 
ue using data of a predetermined portion of a stream of 
content data, and decrypting data of a first portion of 
encrypted content data using the initial value and out- 
putting the decrypted data, and chain-decrypting data 
of a second portion that is different from the first portion 
using the data of the first portion of the encrypted con- 
tent data. 

[0036] Data of a content is block segmented and 
chain-encrypted. An initial value for the encrypting proc- 
ess is generated using the current sector of the data of 
the content. Thus, it is not necessary to generate the 
initial value using a random number or the like. As a re- 
sult, there is no loss in the data area. In addition, since 
data of a content varies at random, the secrecy is high. 
In addition, since it is not necessary to provide a random 
number generator or the like, the circuit scale does not 
increase. 

[0037] I n addition , an initial value generated using da- 
ta of a content is encrypted using data of another con- 
tent. Moreover, data of a content used as an initial value 
can be freely selected. Thus, the secrecy further im- 
proves. 

[0038] When an MPEG stream is recorded, an initial 
value is generated using unique information contained 



in a header. The information of the header is unique. 
Time information such as SCR and PTS chronologically 
varies. Thus, the secrecy is high. In addition, since an 
initial value for an encrypting process is generated using 
5 information of a header of an MPEG stream, the MPEG 
♦ stream can be directly transmitted. Moreover, since it is 
not necessary to provide a random number generator 
or the like, the circuit scale does not increase. 

10 Brief Description of Drawings 

[0039] Fig. 1 is a schematic diagram showing an ex- 
ample of an optical disc according to the present inven- 
tion; Fig. 2 is a block diagram showing an example of a 
15 recording apparatus according to the present invention; 
Fig. 3 is a block diagram showing an example of a re- 
producing apparatus according to the present invention; 
Fig. 4 is a schematic diagram showing the structure of 
a sector; Fig. 5 is a schematic diagram showing the 
20 structure of blocks; Fig. 6 is a block diagram for explain- 
ing an encrypting process according to the present in- 
vention; Fig. 7 is a block diagram for explaining the en- 
crypting process according to the present invention; Fig. 
8 is a block diagram for explaining a decrypting process 
25 according to the present invention; Fig. 9 is a block di- 
agram for explaining a decrypting process according to 
the present invention; Figs. 10, 11, 12, 13, 14, 15, and 
16 are flow charts for explaining the encrypting process 
according to the present invention; Fig. 1 7 is a schemat- 
ic ic diagram for explaining the case that an MPEG stream 
is recorded; Fig. 18 is a schematic diagram for explain- 
ing the case that an MPEG stream is recorded; Fig. 19 
is a schematic diagram showing a block structure in the 
case that an MPEG stream is recorded; Fig. 20 is a block 
35 diagram for explaining an encrypting process according 
to the present invention; Figs. 21 A and 21 B are block 
diagrams for explaining an encrypting process accord- 
ing to the present invention; Fig. 22 is a block diagram 
for explaining an encrypting process according to the 
40 present invention ; Fig. 23 is a block diagram for explain- 
ing an encrypting process according to the present in- 
vention; Fig. 24 is a block diagram for explaining a de- 
crypting process according to the present invention; Fig. 
25 is a block diagram for explaining a conventional en- 
45 crypting process; and Fig. 26 is a block diagram for ex- 
plaining a conventional encrypting process. 

Best Modes for Carrying out the Invention 

50 [0040] Next, with reference to the accompanying 
drawings, an embodiment of the present invention will 
be described. The present invention is suitable for en- 
crypting data of a content so as to protect the data when 
ft is recorded to and reproduced from for example a CD 

55 (Compact Disc) 2. 

[0041 ] Fig. 1 shows an external structure of a CD2 ac- 
cording to the present invention. As with a conventional 
CD, the CD2 is an optical disc having a diameter of for 
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example 120 mm. However, as with a so-called single 
CD, the diameter of the CD2 may be 80 mm. 
[0042] The CD2 has been designated to have an af- 
finity with both a conventional CD player and a personal 
computer. As shown in Fig. 1 , the CD2 has a center hole. 
On the inner periphery side, an area AR1 is formed. On 
an outer periphery of the area AR1 , an area AR2 is 
formed. A mirror portion M 1 is formed between the inner 
periphery area AR1 and the outer periphery area AR2. 
The mirror portion M1 separates the inner periphery ar- 
ea AR1 from the outer periphery area AR2. On the in- 
nermost periphery of the inner periphery area AR1, a 
lead-in area LIN1 is formed. On the outermost periphery, 
a lead-out area LOUT1 is formed. On the innermost pe- 
riphery of the outermost periphery area AR2, a lead-in 
area LIN2 is formed. On the outer periphery of the outer 
periphery area AR2, a lead-out area LOUT2 is formed. 
[0043] The inner periphery area AR1 is an area that 
has an affinity with a conventional CD player. In the area 
AR1 , for example audio data is recorded in the same 
format as the conventional CD-DA (CD Digital Audio) so 
that the data can be reproduced by a conventional CD 
player. In addition, data recorded in the inner periphery 
area AR1 is not encrypted so that the data can be treat- 
ed in the same manner as the regular CD-DA. Of course, 
to protect the copyright of data recorded in the inner pe- 
riphery area AR1, the data may be encrypted. In addi- 
tion, in the inner periphery area AR1 , non-audio data for 
example video data or computer program data may be 
recorded. In addition, compressed data of a content may 
be recorded in the inner periphery area AR1 . 
[0044] In contrast, the outer periphery area AR2 is an 
area that has an affinity with a personal computer. In the 
outer periphery area AR2, data can be recorded in dou- 
ble density. In the area AR2, compressed audio data is 
recorded. The compressing system is for example MP3 
(MPEG-1 Audio Layer-3) system. In addition, to allow 
the outer periphery area AR2 to have an affinity with a 
personal computer, data is recorded as a file in the outer 
periphery area AR2. 

[0045] The MP3 system is one of three layer com- 
pressing systems prescribed in MPEG 1 . Outputs of in- 
dividual bands are divided on the frequency axis corre- 
sponding to MDCT (Modified Discrete Cosine Trans- 
form), quantized, and then Huffman-encoded. When au- 
dio data is compressed corresponding to the MP3 sys- 
tem, the record capacity can be increased. In addition, 
data can be handled as a file of a personal computer. 
Thus, data of a content recorded as a file in the outer 
periphery area AR2 corresponding to the MP3 system 
can be moved to a hard disk of a personal computer so 
that a music server is formed in the personal computer. 
Alternatively, data of a content recorded as a file in the 
outer periphery area AR2 may be moved to a flash mem- 
ory of a portable MP3 reproducing player so that the us- 
er can reproduce and enjoy songs outdoors. 
[0046] In such a manner, data of a content recorded 
in the outer periphery area AR2 has a affinity with a per- 



sonal computer. Thus, data of a content recorded in the 
outer periphery area AR2 can be easily handled. How- 
ever, data of a content recorded in the outer periphery 
area AR2 is often moved to the outside. Thus, there is 

s a possibility of which the copyright of such data may not 
be protected. Thus, to restrict the copying operation and 
the reproducing operation of data of a content recorded 
in the outer periphery area AR2, the data is encrypted. 
In addition, copyright management information that rep- 

10 resents copy prohibition/permission, copy generation 
management, restriction of number of times of coping 
operation, reproduction prohibition/permission, restric- 
tion of number of times of reproducing operation, and 
restriction of reproduction time period is recorded in the 

15 outer periphery area AR2. 

[0047] In this example, data recorded in the area AR2 
is treated as a file corresponding to the MP3 system. Of 
course, data of a content recorded in the area AR2 is 
not limited to a file corresponding to the MP3 system. 

20 Other examples of the compressing system of audio da- 
ta are MPEG2-AAC (Advanced Audio Coding) and AT- 
RAC (Adaptive TRansform Acoustic Coding) 3. Besides 
audio data, various types of data such as video data, 
still picture data, text data, and computer programs can 

25 be recorded to the area AR2. In addition, when not nec- 
essary, data of a content recorded to the area AR2 may 
not be encrypted. 

[0048] In such a manner, in the CD2, using the inner 
periphery area AR1 , data can be reproduced with a CD 
30 player in the same manner as the conventional CD. In 
addition, using the outer periphery area AR2, data can " 
be handled in association with both a personal computer 
and a portable player. 

[0049] The present invention is suitable for the case 
35 that data of a content that is encrypted is recorded to 
the outer periphery area AR2 of such a CD2 and repro- 
duced therefrom. 

[0050] Fig. 2 shows an example of a recording appa- 
ratus according to the present invention. In Fig. 2, con- 

40 tent data is supplied to an input terminal 1 . The content 
data is for example PCM data or an MP3 stream. Alter- 
natively, various types of data such as moving picture 
data, still picture data, game program data, web page 
data, and text may be recorded as content data. The 

45 content data is supplied from the input terminal 1 to an 
encrypting circuit 4. 

[0051] In addition, key information K is supplied to an 
input terminal 2. The key information K supplied from 
the input terminal 2 is supplied to the encrypting circuit 4. 

50 [0052] The encrypting circuit 4 encrypts the content 
data supplied from the input terminal 1 using the key 
information K supplied from the input terminal 2. The en- 
crypting system is for example block encrypting system. 
In the block encrypting system, data is encrypted in the 

55 unit of for example eight bytes. The encrypting circuit 4 
has a block segmenting circuit. In the example, data that 
is encrypted in the unit of a block is chained so as to 
improve the encrypting strength. The encrypting system 
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of which data that has been encrypted in the unit of a 
block is chained is known as CBC (Ciphering Block 
Chaining) system. 

[0053] An output of the encrypting circuit 4 is supplied 
to an error correction code encoding circuit 5. The error 
correction code encoding circuit 5 adds an error correc- 
tion code to the content data that has been encrypted 
by the encrypting circuit 4. 

[0054] An output of th e error correction code encoding 
circuit 5 is supplied to a modulating circuit 6. The mod- 
ulating circuit 6 modulates record data corresponding to 
a predetermined modulating system. An output of the 
modulating circuit 6 is supplied to a recording circuit 7. 
[0055] An output of the recording circuit 7 is supplied 
to an optical pickup 8. The recording circuit 7 is control- 
led by a system controller 1 3. Data is recorded to an 
optical disc 10 by the optical pickup 8. The optical disc 
10 is for example a CD2 disc. 

[0056] The optical pickup 8 can be moved in the radi- 
us direction of the optical disc 10. In addition, various 
types of servo circuits are disposed (not shown). They 
are a tracking servo circuit, a focus servo circuit, a spin- 
dle servo circuit, and so forth. The tracking servo circuit 
causes laser light of the optical pickup 8 to be radiated 
along a track of the optical disc 10. The focus servo cir- 
cuit causes a spot of the laser light of the optical pickup 
8 to be focused on the optical disc 1 0. The spindle servo 
circuit controls the rotation of the optical disc 10. 
[0057] The key information K that is supplied from the 
input terminal 2 is supplied to a mixing circuit 9. Copy- 
right management information R is supplied to an input 
terminal 3. The copyright management information R is 
supplied to the mixing circuit 9 through a rewriting circuit 
11. An output of the mixing circuit 9 is supplied to the 
optical pickup 8 through a recording circuit 12. The op- 
tical pickup 8 records the key information K and the cop- 
yright management information R to the optical disc 10 
through the recording circuit 12. 
[0058] The copyright management information R is in- 
formation that represents copy prohibition/permission, 
copy generation management, restriction of number of 
times of coping operation, reproduction prohibition/per- 
mission, restriction of number of times of reproducing 
operation, and restriction of reproduction time period. 
When the copy generation is managed, the number of 
times of coping operation is restricted, the number of 
times of reproducing operation is restricted, or the re- 
production time period is restricted, whenever the cop- 
ing operation or the reproducing operation is performed, 
it is necessary to rewrite the copyright management in- 
formation R. The copyright management information R 
is rewritten by the rewriting circuit 11 . 
[0059] It can be considered that the key information 
K and the copyright management information R are re- 
corded in a lead-in area or a lead-out area of the optical 
disc 1 0 or recorded as wobbled data in the radius direc- 
tion of a track. 

[0060] Fig. 3 shows the structure of a reproducing 



system. In Fig. 3, a record signal of an optical disc 20 is 
reproduced by an optical pickup 22. The optical disc 20 
corresponds to the optical disc 10 shown in Fig. 2. The 
optical disc 20 is for example a CD2. An output of the 

s optical pickup 22 is supplied to a demodulating circuit 
24 through a reproducing amplifier 23. The operation of 
the optical pickup 22 is controlled by an access control- 
ling circuit 30 under the control of a system controller 
29. The access controlling circuit 30 is composed of ser- 

10 vo circuits that are an optical pickup moving mechanism, 
a tracking servo circuit, and a focus servo circuit. The 
tracking servo circuit causes laser light of the optical 
pickup 22 to be radiated along a track of the optical disc 
20. The focus servo circuit causes a spot of laser light 

15 of the input terminal 2 to be focused on the optical disc 
20. 

[0061] An output of the demodulating circuit 24 is sup- 
plied to an error correcting circuit 25. The error correct- 
ing circuit 25 performs an error correcting process for a 

20 signal that is supplied from the demodulating circuit 24. 
An output of the error correcting circuit 25 is supplied to 
a decrypting circuit 26. In addition, the output of the error 
correcting circuit 25 is supplied to a key management 
information reading circuit 27. An output of the key man- 

25 agement information reading circuit 27 is supplied to the 
decrypting circuit 26. 

[0062] The decrypting circuit 26 performs a decrypt- 
ing process for the reproduced data using the key infor- 
mation K that is read by the key management informa- 

30 tion reading circuit 27. As was described above, in the 
example, as the encrypting system, the CBC system is 
used. The decrypting circuit 26 performs a decrypting 
process for data that has been encrypted corresponding 
to the CBC system. 

35 [0063] An output of the decrypting circuit 26 is sup- 
plied to a reproducing circuit 28. An output of the repro- 
ducing circuit 28 is output from an output terminal 31 . 
Using the copyright management information R that is 
read by the key management information reading circuit 

40 27, the copying operation and the reproducing operation 
are restricted. 

[0064] As was described above, in the example, as 
the encrypting system, the CBC system is used. In other 
words, in the recording system, the encrypting circuit 4 

45 performs an encrypting process forthe input content da- 
ta corresponding to the CBC system. In the reproducing 
system, the decrypting circuit 26 performs a decrypting 
process for the reproduced content data. 
[0065] The block encrypting system may be DES, 

50 AES, FEAL, or MISTY. 

[0066] In the CBC system, encrypted data is chained 
in the unit of a block so as to improve the encrypting 
strength. In the example, as shown in Fig. 4, 2048 bytes 
are defined as one sector. In the unit of a sector, data is 

55 recorded to and reproduced from the optical disc 10 
(20). 

[0067] In other words, in a CD, a sub code block com- 
posed of 98 frames is defined as one sector. The size 
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of the area of one sector is 2352 bytes. 2048 bytes of 

the 2352 bytes are used as a data area. 

[0068] When data is encrypted corresponding to the 

DES system, 64 bits are processed as one block. A key 

of 56 bits is used. Thus, as shown in Fig. 5, one sector 5 

is divided into 256 blocks in the unit of eight bytes (64 

bits). 

[0069] In each sector, each block is chained with the 
immediately preceding block so as to perform an en- 
crypting process corresponding to the CBC system. 10 
[0070] In other words, in the CBC system, the current 
block data and data of which the immediately preceding 
block data has been encrypted are ex-ORed. The re- 
sultant data is encrypted. After one sector has been en- 
crypted corresponding to the CBC system, the next sec- is 
tor is encrypted corresponding to the CBC system in the 
same manner. 

[0071] Thus, in the example, corresponding to the 
CBC system, the encrypting strength is improved. In 
each sector, the encrypting process is performed corre- 20 
sponding to the CBC system. Thus, even if data cannot 
be reproduced due to an occurrence of an error, the in- 
fluence does not adversely affect the other sectors. 
[0072] According to the embodiment of the present in- 
vention, as an initial value, data of a block of the same 25 
sector is used. Since data of a block of the same sector 
is used as an initial value, there is no loss in the data 
area. When content data is music data or video data, 
the value itself varies at random. Thus, when content 
data is used, the secrecy of the initial value becomes 30 
high. 

[0073] When data of a block of the same sector is 
used as an initial value, the data itself does not have a 
high secrecy. Thus, it can be considered that encrypted 
data of a block of the same sector is used as an initial 35 
value. In addition, in the example, data of one block of 
the same sector and data of another block of the same 
sector are ex-ORed. The resultant data is encrypted and 
used as an initial value. 

[0074] Next, with reference to Figs. 6 and 7, the en- 40 
crypting process will be described. Fig. 6 shows a proc- 
ess for generating an initial value. Fig. 7 shows a proc- 
ess for performing a chain-block-encrypting process. 
[0075] When an encrypting process is performed, as 
shown in Fig. 6, an initial value is generated. *s 
[0076] In other words, as shown in Fig. 6, one block 
data Dj of block data DO to D255 of one sector is sup- 
plied to an ex-OR gate 101. In addition, a function f (Di) 
of one block data Di that is not the block data Dj of the 
same sector is supplied to the ex-OR gate 101. 50 
[0077] The ex-OR gate 101 ex-ORes the block data 
Dj and the function f (Di) of the block data Di that is not 
the block data Dj. 

[0078] In this case, a plurality of block data Di that are 
not the block data Dj may be used. Thus, a plurality of 55 
functions f (Di) may be used. In addition, the function(s) 
f (Di) may be any function(s). 

[0079] An output of the ex-OR gate 1 01 is supplied to 



a block encrypting circuit 102. The block encrypting cir- 
cuit 102 encrypts the output of the ex-OR gate 101 using 
key information K. As a result, an initial value inV is ob- 
tained. This value is also used as data EDj of which the 
block data Dj is encrypted. 

[0080] After the initial value has been obtained, as 
shown in Fig. 7, using the initial value, the current block 
data and data of which the immediately preceding block 
data has been encrypted are ex-ORed. The resultant 
data is encrypted. When the current block data is Dj, the 
data EDj that is an initial value is used as encrypted 
block data. 

[0081] In other words, when input block data Dj used 
as an initial value is one of (j - 1 to 254), the input block 
data Dj is encrypted in the following manner. 
[0082] First of all, an ex-OR gate 111 ex-ORes input 
block data DO and the initial value inV obtained in the 
process shown in Fig. 6. An output of the ex-OR gate 
111 is supplied to a block encrypting circuit 112. 
[0083] The block encrypting circuit 112 obtains en- 
crypted block data EDO using the output of the ex-OR 
gate 111 and the key information K. 
[0084] Thereafter, the ex-OR gate 111 ex-ORes input 
block data D1 and the encrypted block data EDO. An 
output of the ex-OR gate 111 is supplied to the block 
encrypting circuit 112. The block encrypting circuit 112 
obtains encrypted block data ED1 using the output of 
the ex-OR gate 111 and the key information K. 
[0085] In the same manner, using input data D2, 
D3, and so forth, encrypted block data ED2, ED3, ... 
and so forth are obtained. 

[0086] The input block data D2, D3, and so forth 
are encrypted. When the input block data becomes Dj, 
the initial value inV obtained in the process shown in 
Fig. 6 is output as the encrypted block data EDj. 
[0087] Thereafter, the ex-OR gate 111 ex-ORes the 
input block data Di and the encrypted block data EDi-1 . 
An output of the ex-OR gate 111 is supplied to the block 
encrypting circuit 112. The block encrypting circuit 112 
obtains the encrypted block data EDi using the output 
of the ex-OR gate 111 and the key information K. 
[0088] Until the input block data D255 is encrypted 
and thereby the encrypted block data ED255 is output, 
the same process is repeated. 

[0089] When the input block data Dj that is input as 
the initial value is the first block data (j = 0), the encrypt- 
ing process is performed in the following manner. 
[0090] First of all, the initial value inV obtained in the 
process shown in Fig. 6 is output as the encrypted block 
data EDO. 

[0091] Thereafter, the ex-OR gate 111 shown in Fig. 
7 ex-ORes the input block data D1 and the encrypted 
block data EDO (equal to the initial value InV). An output 
of the ex-OR gate 1 1 1 is supplied to the block encrypting 
circuit 112. The block encrypting circuit 112 obtains the 
encrypted block data ED1 using the output of the ex-OR 
gate 111 and the key information K. 
[0092] Until the input data D255 is encrypted and 
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thereby the encrypted block data ED255 is output, the 
same process is repeated. Using the input data D2, 

D3 and so forth, the encrypted block data ED2, 

ED3, .... and so forth are obtained. 
[0093] When the input block data Dj used as the initial 
value is the last block data (j = 255), the encrypting proc- 
ess is performed in the following manner. 
[0094] First of all, the ex-OR gate 1 1 1 shown in Fig. 7 
ex-ORes the input block data DO and the initial value 
inV obtained in the process shown in Fig. 6. An output 
of the ex-OR gate 1 1 1 is supplied to the block encrypting 
circuit 112. 

[0095] The block encrypting circuit 1 1 2 obtains the en- 
crypted block data EDO using the output of the ex-OR 
gate 111 and the key information K. 
[0096] Thereafter, the ex-OR gate 111 ex-ORes the 
input block data D1 and the encrypted block data EDO. 
An output of the ex-OR gate 1 1 1 is supplied to the block 
encrypting circuit 112. The block encrypting circuit 112 
obtains the encrypted block data ED1 using the output 
of the ex-OR gate 111 and the key information K. 
[0097] Thereafter, in the same manner, using the in- 
put data D2, D3, and so forth, the encrypted block 
data ED2, ED3, and so forth are obtained. Until the 
encrypted block data ED254 of the input data D254 is 
obtained, the same process is repeated. 
[0098] When the current block data becomes the last 
block data D255, the initial value inV obtained in the 
process shown in Fig. 6 is output as the encrypted block 
data ED255. 

[0099] Next, with reference to Figs. 8 and 9, a decrypt- 
ing process will be described. Fig. 8 shows a process 
for performing a chain-block-encrypting process. Fig. 9 
shows a process for decrypting block data of which an 
initial value has been encrypted. 
[0100] When input block data Dj that is used as an 
initial value is one of (j = 1 to 254), the decrypting proc- 
ess is performed in the following manner. 
[0101] First of all, as shown in Fig. 8, encrypted block 
data EDO and key information K are supplied to an en- 
crypted block decrypting circuit 121. The encrypted 
block decrypting circuit 1 21 performs a decrypting proc- 
ess using the encrypted block data EDO and the key in- 
formation K. 

[0102] An output of the encrypted block decrypting cir- 
cuit 121 is supplied to an ex-OR gate 122. In addition, 
an initial value inV is supplied to the ex-OR gate 122. 
The initial value inV is encrypted block data EDj. 
[01 03] The ex-OR gate 1 22 ex-ORes the output of the 
encrypted block decrypting circuit 1 21 and the encrypt- 
ed block data EDj and obtains block data DO. 
[0104] Thereafter, encrypted block data ED1 and the 
key information K are supplied to the encrypted block 
decrypting circuit 121 . The encrypted block decrypting 
circuit 121 performs the decrypting process using the 
encrypted block data ED1 using the key information K. 
An output of the encrypted block decrypting circuit 121 
is supplied to the ex-OR gate 122. 



[0105] In addition, the immediately preceding en- 
crypted block data EDO is supplied to the ex-OR gate 
122. 

[0106] The ex-OR gate 1 22 ex-ORes the output of the 
5 encrypted block decrypting circuit 1 21 and the immedi- 
ately preceding encrypted block data EDO and obtains 
block dataDI. 

[0107] Thereafter, in the same manner, using the en- 
crypted block data ED1 , ED2, and so forth, the block 

10 data D1 , D2, and so forth are obtained. 

[0108] While the block data D2, D3, and so forth 
are obtained, when the block data to be decrypted be- 
comes the encrypted block data EDj that is the same as 
the initial value, as shown in Fig. 9, the encrypted block 

is data EDj and the key information K are supplied to an 
encrypted block decrypting circuit 131. The encrypted 
block decrypting circuit 131 performs the decrypting 
process using the encrypted block data EDj and the key 
information K. 

20 [0109] An output of the encrypted block decrypting cir- 
cuit 131 is supplied to an ex-OR gate 132. In addition, 
a function f (Di) of data that is not the block data Dj is 
supplied to the ex-OR gate 132. 
[01 1 0] The ex-OR gate 1 32 ex-ORes the output of the 

25 encrypted block decrypting circuit 131 and the function 
f (Di) of data that is not the block data Dj and obtains 
block data Dj. 

[01 1 1 ] After the block data Dj has been obtained, re- 
turning to the process shown in Fig. 8, the encrypted 

30 block data EDi and the key information K are supplied 
to the encrypted block decrypting circuit 121 . The en- 
crypted block decrypting circuit 121 performs the de- 
crypting process using the encrypted block data EDi and 
the key information K. An output of the encrypted block 

35 decrypting circuit 121 is supplied to the ex-OR gate 122. 
In addition, the immediately preceding encrypted block 
data EDi-1 is supplied to the ex-OR gate 122. The 
ex-OR gate 122 ex-ORes the output of the encrypted 
block decrypting circuit 121 and the immediately pre- 

^o ceding encrypted block data EDi-1 and obtains block da- 
ta Di. - 

[0112] Thereafter, until the encrypted block data 
ED255 is decrypted, the same process is repeated. 
[01 13] When the input block data Dj used as the initial 

45 value is the first block data (j = 0), the decrypting process 
is performed in the following manner. 
[0114] First of all, as shown in Fig. 9, the encrypted 
block data EDO and the key information K are supplied 
to the encrypted block decrypting circuit 131 . The en- 

50 crypted block decrypting circuit 131 performs the de- 
crypting process using the encrypted block data EDO 
and the key information K. 

[01 1 5] An output of the encrypted block decrypting cir- 
cuit 131 is supplied to the ex-OR gate 132. In addition, 
55 a function f (Di) of data that is not the block data DO is 
supplied to the ex-OR gate 132. 
[0116] Theex-ORgate 132 ex-ORes the output of the 
encrypted block decrypting circuit 131 and the function 
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f (Di) of data that is not the block data Dj and obtains 
the block data DO. 

[01 1 7] After the block data DO has been obtained, as 
shown in Fig. 8, the encrypted block data ED1 and the 
key information K are supplied to the encrypted block 
decrypting circuit 121. The encrypted block decrypting 
circuit 121 performs the decrypting process using the 
encrypted block data ED1 and the key information K. 
[01 1 8] An output of the encrypted block decrypting cir- 
cuit 121 is supplied to the ex-OR gate 122. In addition, 
the initial value inV is supplied to the ex-OR gate 122. 
The initial value inV is encrypted block data EDO. 
[01 1 9] The ex-OR gate 1 22 ex-ORes the output of the 
encrypted block decrypting circuit 121 and the encrypt- 
ed block data EDO and obtains the block data D1 . 
[0120] Thereafter, the encrypted block data ED2 and 
the key information K are supplied to the encrypted 
block decrypting circuit 121. The encrypted block de- 
crypting circuit 121 performs the decrypting process us- 
ing the encrypted block data ED2 and the key informa- 
tion K. 

[01 21 ] An output of the encrypted block decrypting cir- 
cuit 121 is supplied to the ex-OR gate 122. In addition, 
the immediately preceding encrypted block data ED1 is 
supplied to the ex-OR gate 122. 
[0122] The ex-OR gate 122 ex-ORes the output of the 
encrypted block decrypting circuit 121 and the immedi- 
ately preceding encrypted block data ED1 and obtains 
block data D2. 

[0123] Thereafter, until the encrypted block data 
ED255 is decrypted, the same process is repeated. 
[0124] When the input block data used as the initial 
value is the last block data (j = 255), the decrypting proc- 
ess is performed in the following manner. 
[0125] First of all, as shown in Fig. 8, encrypted block 
data EDO and key information K are supplied to the en- 
crypted block decrypting circuit 121. The encrypted 
block decrypting circuit 121 performs the decrypting 
process using the encrypted block data EDO and the key 
information K. 

[0126] An output of the encrypted block decrypting cir- 
cuit 121 is supplied to the ex-OR gate 122. In addition, 
an initial value inV is supplied to the ex-OR gate 122. 
The initial value inV is encrypted block data ED255. 
[01 27] The ex-OR gate 1 22 ex-ORes the output of the 
encrypted block decrypting circuit 121 and the encrypt- 
ed block data ED255 and obtains block data DO. 
[0128] Thereafter, the encrypted block data ED1 and 
the key information K are supplied to the encrypted 
block decrypting circuit 121. The encrypted block de- 
crypting circuit 121 performs the decrypting process us- 
ing the encrypted block data ED1 and the key informa- 
tion K. An output of the encrypted block decrypting cir- 
cuit 121 is supplied to the ex-OR gate 122. 
[0129] In addition, the immediately preceding en- 
crypted block data EDO is supplied to the ex-OR gate 
122. 

[01 30] The ex-OR gate 1 22 ex-ORes the output of the 
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encrypted block decrypting circuit 121 and the immedi- 
ately preceding encrypted block data EDO and obtains 
block data D1. 

[0131] Thereafter, in the same manner, using the en- 

5 crypted block data ED2, ED3, and so forth, block da- 
ta D2, D3, and so forth are obtained. 
[0132] After the encrypted block data ED254 has 
been decrypted and thereby block data D254 has been 
obtained, as shown in Fig. 9, the encrypted block data 

10 ED255 and the key information K are supplied to the 
encrypted block decrypting circuit 121. The encrypted 
block decrypting circuit 131 performs the decrypting 
process using the encrypted block data ED255 and the 
key information K. 

15 [0133] An output of the encrypted block decrypting cir- 
cuit 131 is supplied to the ex-OR gate 132. In addition, 
a function f (Di) of data that is not the block data Dj is 
supplied to the ex-OR gate 132. 
[01 34] The ex-OR gate 1 32 ex-ORes the output of the 

20 encrypted block decrypting circuit 131 and a function f 
(Di) of data that is not the block data Dj and obtains block 
data D255. 

[01 35] In the forgoing example, the chain, initial value, 
and key information are processed with 64 bits each. 
25 However, they may be processed with 128 bits each or 
256 bits each. 

[01 36] Figs. 1 0 to 12 are flow charts showing a proc- 
ess for encrypting data and recording the encrypted da- 
ta. In the process, one sector composed of for example 

30 2048 bytes is encrypted corresponding to the CBC sys- 
tem. One sector is divided into 256 blocks each of which 
is composed of eight bytes (64 bits). 
[0137] In Fig. 10, block data Dj of block data DO to 
D255 of one sector (for example, 2048 bytes) is read (at 

35 step S1). The block data Dj and a function f (Di) of the 
block data Di are ex-ORed. The resultant data is en- 
crypted using key information K. As a result, an initial 
value inV is generated (at step S2). The initial value inV 
is stored (at step S3). 

40 [01 38] It is determined whether or not the block data 
Dj used to generate the initial value is the first block data 
0 = 0) (at step S4). 

[0139] When the block data Dj is the first block data 
(j = 0), the initial value inV is read (at step S5). The initial 

45 value inV is treated as the encrypted block data EDO of 
the block data DO (at step S6). The obtained encrypted 
block data EDO is stored (at step S7). 
[0140] The number i of the block data is initialized to 
"1" (i = 1) (at step S8). The initial value inV is read (the 

so initial value inV is the same as the encrypted block data 
DO) (at step S9). The block data D1 is read (at step S1 0). 
The initial value inV and the block data D1 are ex-ORed. 
The resultant data is encrypted using the key informa- 
tion K. As a result, the encrypted block data ED1 of the 

55 block data D1 is generated (at step S11). The encrypted 
block data EDi is stored (at step S12). The number i of 
the block data is incremented to "2" (i = 2) (at step S13). 
[0141] After the number i of the block data has been 
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incremented, the encrypted block data EDi-1 is read (at 
step S14). Thereafter, the block data Di is read (at step 
S15). The encrypted block data EDi-1 and the block data 
Di are ex-ORed. The resultant data is encrypted using 
the key information K. As a result, the encrypted block 
data EDi of the block data Di is generated (at step S1 6). 
The encrypted block data EDi is stored (at step S17). 
The number i of the block data is incremented (at step 
S18). 

[0142] It is determined whether or not the block 
number i is "256" (at step S1 9). When the block number 
is not "256", the flow returns to step S14. Until the block 
number i becomes "256", the same process is repeated. 
As a result, the encrypted block data EDi is obtained. 
When the block number i becomes "256" and the block 
data D255 has been processed, the process is complet- 
ed. 

[0143] When the block data Dj used to generate the 
initial value is not the first block data (j = 0) at step S4, 
as shown-in Fig. 11, it is determined whether or not the 
block data Dj used to generate the initial value is the last 
block data (j = 255) (at step S20). 
[0144] When the block number is "255" (j = 255), the 
block number is initialized to "0" (i = 0) (at step S21). 
The initial value inV obtained at step S2 is read (at step 
S22). As a result, the block data DO is read (at step S23). 
The initial value inV and the block data DO are ex-ORed. 
The resultant data is encrypted using the key informa- 
tion K. As a result, the encrypted block data EDO of the 
block data DO is generated (at step S24). The encrypted 
block data EDO is stored (at step S25). The number i of 
the block data is incremented to "1 " (i = 1 ) (at step S26). 
[0145] After the number i of the block data has been 
incremented, the encrypted block data EDi-1 is read (at 
step S27). Thereafter, the block data Di is read (at step 
S28). The encrypted block data EDi-1 and the block data 
Di are ex-ORed. The resultant data is encrypted using 
the key information K. As a result, the encrypted block 
data EDi of the block data Di is generated (at step S29). 
The encrypted block data EDi is stored (at step S30). 
Thereafter, the number i of the block data is incremented 
(at step S31). 

[0146] It is determined whether or not the block 
number i is "255" (at step S32). When the block number 
i is not "255", the flow returns to step S27. Until the block 
number i becomes "255" , the same process is repeated. 
As a result, the encrypted block data EDi is obtained. 
[0147] When the block number is "255", the initial val- 
ue inV obtained at step S2 is read (at step S33). The 
initial value inV is treated as the encrypted block data 
ED255 (at step S34). The encrypted block data ED255 
is stored (at step S35). Thereafter, the process is com- 
pleted. 

[0148] When the determined result represents that 
the block data Dj used to generate the initial value at 
step S4 is not the first block data 0 = 0) and that the 
block data Dj is not the last block data (j = 255) at step 
S20, as shown in Fig. 12, the number i of the block data 
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is initialized to "0" (i = 0) (at step S36). The initial value 
inV obtained at step S2 is read (at step S37). Thereafter, 
the block data DO is read (at step S38). The initial value 
inV and the block data DO are ex-ORed. The resultant 

5 data is encrypted using the key information K. As a re- 
sult, the encrypted block data EDO of the block data DO 
is generated (at step S39). The encrypted block data 
EDO is stored (at step S40). The number i of the block 
data is incremented to "1" (i = 1) (at step S41). 

10 [0149] After the number i of the block data has been 
incremented, it is determined whether or not the current 
block number i is the number j used to generate the initial 
value (j = i) (at step S42). When the number i of the block 
data is not the number j (j * i), the encrypted block data 

15 EDi-1 is read (at step S43). The block data Di is read (at 
step S44) . The encrypted block data EDi-1 and the block 
data Di are ex-ORed. The resultant data is encrypted 
using the key information K. As a result, the encrypted 
block data EDi of the block data Di is generated (at step 

20 S45). The encrypted block data EDi is stored (at step 
S46). Thereafter, the number i of the block data is incre- 
mented (at step S47). 

[0150] It is determined whether or not the block 
number i is "256" (at step S48). When the block number 

25 j j s not "256", the flow returns to step S42. 

[0151] When the determined result at step S42 repre- 
sents that the block number i is the number j (j = i), the 
initial value inV obtained at step S2 is read (at step S49). 
The initial value inV is treated as the encrypted block 

30 data EDj of the block data Dj (at step S50) . The encrypt- 
ed block data EDj is stored (at step S51 ). Thereafter, the 
flow advances to step S47. 

[0152] Until the block number i becomes "256", the 
same process is repeated. After the block number i be- 

35 comes "256" and the encrypted block data of the block 
data D255 has been obtained, the process is completed. 
[0153] Thereafter, a decrypting process will be de- 
scribed. Figs. 13 to 16 are flow charts showing a de- 
crypting process. 

40 [0154] In Figs. 13 to 16, it is determined whether or 
not a block number j used as an initial value is 0 (j = 0) 
(at step S101). 

[0155] When the block number j is 0 (j = 0), the en- 
crypted block data EDO is read (at step S102). The en- 

45 crypted block data EDO is decrypted using key informa- 
tion K. The decrypted value and a function f(Di) are 
ex-ORed. As a result, the block data DO is generated (at 
step S103). The block data DO is stored (at step S104). 
[0156] The block number i is initialized to "1" (i = 1) 

so (at step S105). Thereafter, the encrypted block data 
ED1 is read (at step S106). Thereafter, the encrypted 
block data EDO is read (at step S107). The encrypted 
block data EDO is treated as the initial value inV (at step 
S108). 

55 [01 57] The encrypted block data ED1 is decrypted us- 
ing the key information K. The decrypted value and the 
initial value inV (that is the same as the encrypted block 
data EDO) are ex-ORed. As a result, the block data D1 
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is generated (at step S109). The generated block data 
D1 is stored (at step S110). Thereafter, the block 
number i is incremented to "2" (i = 2) (at step Sill). 
[0158] Thereafter, the encrypted block data EDi is 
read (at step S1 1 2). Thereafter, the encrypted block da- 5 
ta EDi-1 is read (at step S1 1 3). The encrypted block data 
EDi is decrypted using the key information K. The de- 
crypted value and the encrypted block data EDi-1 are 
ex-ORed. As a result, the block data Di is generated (at 
step S114). The block data Di is stored (at step S115). w 
Thereafter, the block number i is incremented (at step 
S116). 

[0159] It is determined whether or not the block 
number i is "256" (at step S11 7). When the block number 
i is not "256", the flow returns to step S112. Until the 13 
block number becomes "256", the same process is re- 
peated. When the block number becomes "256" and the 
block data D255 has been obtained , the process is com- 
pleted. 

[0160] When the determined result at step S101 rep- 20 
resents that the block number j used as the initial value 
is not 0 (j * 0), as shown in Fig. 14, it is determined 
whether or not the block number j used as the initial val- 
ue is "255" (j = 255) (at step S11 8). 

[01 61 ] When the bock number j is "255" (j = 255) , the 25 
block number i is initialized to "0" (i = 0) (at step S119). 
Thereafter, the encrypted block data EDO is read (at step 
S120). Thereafter, the encrypted block data ED255 is 
read (at step S121). The encrypted block data ED255 
is treated as the initial value inV (at step S1 22). so 
[01 62] The encrypted block data EDO is decrypted us- 
ing the key information K. The decrypted value and the 
initial value inV are ex-ORed. As a result, the block data 
DO is generated (at sep S1 23). The generated block da- 
ta DO is stored (at step S124). Thereafter, the block 35 
number i is incremented to "1" (i = 1) (at step S125). 
[0163] The encrypted block data EDi is read (at step 

5126) . The encrypted block data EDi-1 is read (at step 

5127) . The encrypted block data EDi is decrypted using 

the key information K. The decrypted value and the en- *o 
crypted block data EDi-1 are ex-ORed. As a result, the 
block data Di is generated (at step S 128). The block data 
Di is stored (at step S1 29). Thereafter, the block number 
i is incremented (at step S130). 

[0164] It is determined whether or not the block 45 
number i is "255" (at step S 1 31 ) . When the block number 
i is not "255", the flow returns to step S126. Until the 
block number i becomes "255", the same process is re- 
peated. 

[01 65] When the block number i is "255" and the block 50 
data D254 has been processed, the encrypted block da- 
ta ED255 is read (at step S132). The encrypted block 
data ED255 is decrypted using the key information K. 
The decrypted value and a function f (Di) are ex-ORed. 
As a result, the block data D255 is generated (at step 55 
S133). The block data D255 is stored (at step S134). 
Thereafter, the process is completed. 
[0166] When the determined result at step S101 rep- 



resents that the block number is not "0" (j * 0) and the 
determined result at step S1 1 8 represents that the block 
number j is not "255" (j * 255), as shown in Fig. 15, the 
block number i is initialized to "0" (i = 0) (at step S135). 
[0167] Thereafter, the encrypted block data EDO is 
read (at step S1 36). Thereafter, the encrypted block da- 
ta EDj is read (at step S137). The encrypted block data 
EDj is treated as the initial value inV (at step S138). 
[01 68] The encrypted block data EDO is decrypted us- 
ing the key information K. The decrypted value and the 
initial value inV are ex-ORed. As a result, the block data 
DO is generated (at step S139). The generated block 
data DO is stored (at step S140). Thereafter, as shown 
in Fig. 16, the block number is incremented to "1" (i = 1) 
(at step S1 41). 

[0169] After the number i of the block data has been 
incremented, it is determined whether or not the current 
block number i is the number j used to generate the initial 
value (j = i) (at step S142). 

[0170] When the number j is not the number i (j * i), 
the encrypted block data EDi is read (at step S143). 
Thereafter, the encrypted block data EDi-1 is read (at 
step S144). The encrypted block data EDi is decrypted 
using the key information K. The decrypted value and 
the encrypted block data EDi-1 are ex-ORed. As a re- 
sult, the block data Di is generated (at step S145). The 
block data Di is stored (at step S146). Thereafter, the 
block number i is incremented (at step S147). 
[0171] It is determined whether or not the block 
number i is "256" (atstepS148). When the block number 
i is not "256", the flow returns to step S142. 
[01 72] When the determined result at step S1 42 rep- 
resents that the block number i is the number j (i = j), 
the encrypted block data EDj is read (at step S1 49). The 
encrypted block data EDj is decrypted using the key in- 
formation K. The decrypted value and a function f (Di) 
are ex-ORed. As a result, the block data Dj is generated 
(at step S150). The block data Dj is stored (at step 
S151). Thereafter, the flow advances to step S147. 
[0173] Until the block number becomes "256", the 
same process is repeated. When the block number be- 
comes "256" and the block data D255 has been ob- 
tained, the process is completed. 
[01 74] Block data Dj of which an initial value has been 
encrypted may be placed at a fixed position . Alternative- 
ly, the position of the block data Dj may be varied. When 
the position of the block data Dj is varied, the secrecy 
thereof can be improved. 

[0175] As was described above, according to the 
present invention, an initial value for which blocks are 
chain-encrypted is generated using content data. Thus, 
there is no loss in the data area. In addition, since con- 
tent data varies at random, the secrecy of the initial val- 
ue is high. 

[0176] When content data is music data or the like, it 
is sampled data. Thus, it can be said that the content 
data is randomized data. Consequently, it is very difficult 
to know the level of music data at a particular point. 
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Thus, when the initial value is generated using content 
data, the secrecy thereof is improved as with the case 
that a random number is used for the initial value. 
[01 77] Next, the case that an MPEG stream is record- 
ed as content data will be described. 5 
[0178] As shown in Fig. 1, the CD2 optical disc has 
an inner periphery area AR1 and an outer periphery ar- 
ea AR2. In the outer periphery area AR2, audio data as 
a file corresponding to the MP3 system is recorded. The 
MP3 system is one of three layers of the audio data used 10 
in the MPEG system. Thus, when data corresponding 
to the MP3 system is recorded in the outer periphery 
area AR2, data is recorded corresponding to an MPEG 
stream. 

[01 79] An M PEG stream is composed of an upper lay- 15 
er (program layer and pack layer) and a lower layer 
(packet layer). In other words, in an MPEG stream, the 
sequence of one program is composed of a plurality of 
packs. Regularly, each pack is composed of a plurality 
of packets. At the beginning of each pack, a pack header 20 
is placed. Each packet is composed of a packet header 
and data. 

[0180] In a CD, a block composed of 98 frames is re- 
ferred to as sector. Data is recorded in the unit of a sec- 
tor. 25 
[0181] Fig. 17 shows a data structure of an MPEG 
steam recorded on the CD. As shown in Fig. 17, one 
sector of the CD has a data area of 2048 bytes. Normal- 
ly, packs and packets of the MPEG stream are placed 
in one sector. As shown in Fig. 18, at the beginning of 30 
a file, a file header is placed. At the file header, copyright 
management information is placed. 
[0182] As shown in Fig. 17, at the beginning of one 
sector, a pack header is placed. The pack header is 
composed of for example 14 bytes. The pack header 35 
contains pack start code, SCR (System Clock Refer- 
ence) and bit rate. 

[01 83] The pack header is followed by a packet head- 
er. The packet header is composed of for example 18 
bytes. The packet header contains packet start code, *o 
stream ID, PES (Packetized Elementary Steam) header 
length, and PTS (Presentation Time Stamp). 
[0184] Content date compressed corresponding to 
the MPEG system (for example, compressed audio da- 
ta) is placed in the remaining 201 6 bytes of one sector. 45 
[0185] In such a manner, an MPEG file corresponding 
to the MP3 system is placed in a stream composed of 
packs and packets. As shown in Fig. 18, atthe beginning 
of a file, a file header is placed. The file header contains 
copyright owner management information such as file 50 
ID and ISRC (International Standard Recording Code). 
The ISRC is a 12-digit code that represents master tape 
of the song or that represents song, company, recorded 
year, recording number, and so forth assigned when the 
disc is produced. In addition, a disc ID that identifies the 55 
disc may be assigned. 

[0186] When an MPEG stream is recorded to a CD, 
data of packs and sectors is recoded to a data area of 



one sector of 2048 bytes. Data of 201 6 bytes of one sec- 
tor should be encrypted. In other words, it is not neces- 
sary to encrypt the pack header of 14 bytes and the 
packet header of 1 8 bytes. 

[0187] Fig. 19 shows the structure of blocks in the 
case that one sector of an MPEG stream of content data 
is encrypted. As was described above, 2016 bytes of 
data of one sector should be encrypted. Thus, when an 
MPEG stream is encrypted, as shown in Fig. 19, data 
of one sector is divided into 252 blocks each of which is 
composed of 8 bytes (64 bits). As was described above, 
the blocks are encrypted corresponding to the CBC sys- 
tem. In other words, the current block data and data of 
which the immediately preceding block data has been 
encrypted are ex-ORed. The resultant data is encrypt- 
ed. 

[01 88] When content data is encrypted corresponding 
to the CBC system, an initial value is required. In the 
forgoing example, the initial value is generated using a 
block of the same sector of content data. Likewise, in 
an MPEG stream, an initial value may be generated us- 
ing a block of the same sector. In contrast, in consider- 
ation of the uniqueness of a header of an MPEG stream, 
an initial value necessary forthe encrypting process cor- 
responding to the CBC system may be generated using 
the header of the MPEG stream. 
[01 89] In other words, as shown in Fig. 1 7, an MPEG 
stream contains a pack header and a packet header. As 
shown in Fig. 1 8, at the beginning of a file, a file header 
is placed. It can be considered to generate an initial val- 
ue using these headers. 

[01 90] For example, copyright management informa- 
tion (such as ISRC) and so forth are recorded atthe file 
header. The copyright management information is a val- 
ue that is unique for each content. When there is a disc 
header, a value unique for each disc such as a disc serial 
number is placed in the disc header. Such information 
is unique for each disc. 

[0191] A pack header contains pack start code, SCR, 
and bit rate. The SCR is time information used for com- 
pensating the STC (System Time Clock) as a reference 
of the system. In contrast, a packet header contains 
packet start code, stream ID, PES header length, and 
PTS. The PTS is time information as a reference used 
for reproducing data. Since the SCR of the pack header 
and the PTS of the packet header chronologically vary, 
they are unique values. 

[0192] Using unique information contained in a head- 
er of an MPEG stream, an initial value necessary for en- 
crypting content data corresponding to the CBC system 
can be generated. 

[0193] When an initial value used for the encrypting 
process corresponding to the CBC system is generated 
using unique information of a header of an MPEG 
stream, the information of the header may be used as it 
is. However, when the information of the header is used 
as it is, the secrecy of the initial value is not sufficient. 
[01 94] Thus, it can be considered that an initial value 
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is generated using information of a header of an MPEG 
stream. Alternatively, it can be considered that informa- 
tion of a header is encrypted and using the encrypted 
information, an initial value is generated. In reality, an 
initial value can be generated in the following manner. 
[01 95] It can be considered that by combining unique 
information of a file header such as copyright informa- 
tion and information that chronologically varies such as 
the SCR of a pack header or the PTS of a packet header 
using a particular function, an initial value is generated. 
[0196] Fig. 20 shows an example of a process for gen- 
erating an initial value using unique information of a file 
header such as copyright information and information 
that chronologically varies such as the SCR of a pack 
header or the PTS of a packet header. In Fig. 20, unique 
information of a file header is supplied to an ex-OR gate 
201 . The SCR of a pack header or the PTS of a packet 
header are supplied to the ex-OR gate 201 . The ex-OR 
gate 201 ex-ORes the unique information of the file 
header and the SCR of the pack header or the PTS of 
the packet header. Using the output of the ex-OR gate 
201 , an initial value inV is obtained. 
[0197] Alternatively, it may be considered that by en- 
crypting unique information of a file header such as cop- 
yright information or information that chronologically 
varies such as the SCR of a pack header or the PTS of 
a packet header, an initial value is generated. 
[0198] Fig. 21 A shows an example of a process for 
encrypting unique information of a file header such as 
copyright information and generating an initial value. In 
Fig. 21 A, unique information of a file header is supplied 
to an encrypting circuit 211 . The encrypting circuit 21 1 
encrypts unique information of the file header. Using an 
output of the encrypting circuit 211, an initial value inV 
is obtained. 

[0199] Fig. 21 B shows an example of a process for 
encrypting information that chronologically varies such 
as the SCR of a pack header or the PTS of a packet 
header and generating an initial value. In Fig. 21 B, the 
SCR of the pack header or the PTS of the pack header 
is supplied to an encrypting circuit 221 . The encrypting 
circuit 221 encrypts the SCR or the PTS. Using an out- 
put of the encrypting circuit 221 , an initial value inV is 
obtained 

[0200] Alternatively, it may be considered that by en- 
crypting unique information of a file header such as cop- 
yright information and information that chronologically 
varies such as the SCR of a pack header or the PTS of 
a packet header, an initial value is generated. 
[0201 ] Fig. 22 shows an example of a process for en- 
crypting unique information of a file header such as cop- 
yright information and information that chronologically 
varies such as the SCR of a pack header or the PTS of 
a packet header and generating an initial value. In Fig. 
22, unique information of a file header is supplied to an 
ex-OR gate 231 . In addition, the SCR of a pack header 
or the PTS of a packet header is supplied the ex-OR 
gate 231 . The ex-OR gate 231 ex-ORes the unique in- 



formation of the file header and the SCR of the pack 
header or the PTS of the packet header. An output of 
the ex-OR gate 231 is supplied to an encrypting circuit 
232. The encrypting circuit 232 encrypts the output of 

5 the ex-OR gate 231 . Using the output of the encrypting 
circuit 232, an initial value inV is obtained. 
[0202] Fig. 23 shows an example of an encrypting 
process for encrypting an MPEG stream. In Fig. 23, an 
ex-OR gate 301 -0 ex-ORes input block data DO and an 

10 initial value inV obtained from an MPEG header. An out- 
put of the ex-OR gate 301 -0 is supplied to a block en- 
crypting circuit 302-0. 

[0203] The block encrypting circuit 302-0 obtains en- 
crypted block data EDO using the output of an ex-OR 

is gate 311 and key information K. 

[0204] Thereafter, an ex-OR gate 301-1 ex-ORes in- 
put block data D1 and the encrypted block data EDO. 
An output of the ex-OR gate 301-1 is supplied to a block 
encrypting circuit 302-1. The block encrypting circuit 

20 302-1 obtains encrypted block data ED1 using the out- 
put of the ex-OR gate 301 -1 and the key information K. 
[0205] Likewise, using input data D2, D3, .... and 
D251, encrypted block data ED2, ED3, .... and ED251 
are obtained. 

25 [0206] Fig. 24 shows an example of a decrypting proc- 
ess for decrypting an M PEG stream. In Fig. 24, encrypt- 
ed block data EDO and key information K are supplied 
to an encrypted block decrypting circuit 401-0. The en- 
crypted block decrypting circuit 401 -0 performs the de- 

30 crypting process using the encrypted block data EDO 
and the key information K. 

[0207] An output of the encrypted block decrypting cir- 
cuit 401-0 is supplied to an ex-OR gate 402-0. In addi- 
tion, an initial value inV is supplied to the ex-OR gate 

35 402-0. The initial value inV is encrypted block data inV. 
[0208] The ex-OR gate 402-0 ex-ORes the output of 
the encrypted block decrypting circuit 401-0 and the in- 
itial value inV. As a result, block data DO is obtained. 
[0209] Thereafter, encrypted block data ED1 and the 

40 key information K are supplied to an encrypted block de- 
crypting circuit 401-1. The encrypted block decrypting 
circuit 401 -1 performs the decrypting process using the 
encrypted block data ED1 and the key information K. An 
output of the encrypted block decrypting circuit 401 -1 is 

45 supplied to an ex-OR gate 402-1 . 

[0210] The immediately preceding encrypted block 
data EDO is supplied to an ex-OR gate 402-1 . 
[0211] The ex-OR gate 402-1 ex-ORes the output of 
the encrypted block decrypting circuit 401 -1 and the im- 

50 mediately preceding encrypted block data EDO. As a re- 
sult, block data D1 is obtained. 

[0212] Likewise, using encrypted block data ED1, 

ED2 and so forth, block data D1, D2, and D251 

are obtained. 

55 [0213] Thus, when an MPEG stream is recorded, us- 
ing a header of the MPEG stream, an initial value used 
to perform an encrypting process corresponding to the 
CBC system can be generated because header is 
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unique. In the forgoing example, an initial value is gen- 
erated using a file header and time information such as 
the SCR of a pack header or the PTS of a packet header. 
Alternatively, information of a disc header may be used. 
[0214] In the forgoing example, content data is re- 
corded on a CD2 optical disc. However, the present in- 
vention is not limited to a CD2 optical disc. In addition, 
the present invention can be applied to the case that 
content data is recorded on a CD-DA, a CD-ROM, a 
CD-R, or a CD-RW. In addition to optical discs, the 
present invention can be applied to the case that content 
data is recorded to various types of record mediums 
such as a magnetic disc and a flash memory card. 
[0215] In addition, the present invention is suitable for 
the case that content data is distributed trough a net- 
work. 

[0216] In other words, in recent years, a service that 
distributes content data such as music data is distribut- 
ed through a network has become common. In such a 
service, to protect the right of content data, it is desired 
to encrypt it. According to the present invention, an initial 
value used to chain-encrypt blocks is generated using 
content data or data of an MPEG stream. Thus, the 
present invention is also suitable for encrypting content 
data that is distributed. 

[0217] According to the present invention, content da- 
ta is block-segmented and chain-encrypted. An initial 
value is generated using content data of the sector. 
Thus, it is not necessary to generate the initial-value us- 
ing a random number or the like. Consequently, there is 
no loss in the data area. Since content data varies at 
random, the secrecy of the initial value is high. In addi- 
tion, since a random number generator is not required, 
the circuit scale does not increase. 
[0218] In addition, according to the present invention, 
an initial value generated using content data is encrypt- 
ed using other content data. In addition, content data 
that is used as an initial value can be freely selected." 
Thus, the secrecy of the initial value is improved. 
[0219] In addition, according to the present invention, 
when an MPEG steam is recorded, an initial value is 
generated using unique information contained in a 
header of the MPEG stream. The information of the 
header is unique. The time information such as SCR or 
PTS chronologically varies. Thus, the secrecy of the in- 
itial value is high. In addition, since an initial value used 
to perform an encrypting process is generated using in- 
formation of a header of an MPEG stream, the MPEG 
stream can be transmitted as it is. In addition, it is not 
necessary to provide a random number generator or the 
like. Thus, the circuit scale does not increase. 

Industrial Applicability 

[0220] As descried above, the encrypting apparatus, 
the encrypting method, the decrypting apparatus, the 
decrypting method, and the record medium are suitable 
for encrypting content data and recording the encrypted 



content data so as to protect the right of the content data 
when it is recorded to and/or reproduced from an optical 
disc such as a CD (Compact Disc) 2 optical disc. 

5 

Claims 

1. An encrypting apparatus, comprising: 

10 generating means for generating an initial value 

using data of a first portion of content data; and 
encrypting means for encrypting data of a sec- 
ond portion of the content data using the gen- 
erated initial value, outputting the encrypted 

15 data, and chain-encrypting data of portions oth- 

er than the first portion and the second portion 
of the content data using the output encrypted 
data. 

20 2. The encrypting apparatus as set forth in claim 1 , fur- 
ther comprising: 

dividing means for dividing the content data into 
blocks each of which is composed of a plurality 
25 of bits, 

wherein the generating means generates an 
initial value using data of a first portion of each of 
the divided blocks. 

30 

3. The encrypting apparatus as set forth in claim 2, 

wherein the encrypting means encrypts each 
of the divided blocks corresponding to block en- 
crypting system. 

35 

4. The encrypting apparatus as set forth in claim 1 , 

wherein the initial value is encrypted. 

5. The encrypting apparatus as set forth in claim 1 , 
40 wherein the data of the first portion of the con- 
tent data is variable. 

6. An encrypting method, comprising the steps of: 

45 generating an initial value using data of a first 

portion of content data; and 
encrypting data of a second portion of the con- 
tent data using the generated initial value, out- 
putting the encrypted data, and chain-encrypt- 
50 jng data of portions other than the first portion 

and the second portion of the content data us- 
ing the output encrypted data. 

7. The encrypting method as set forth in claim 6, fur- 
55 ther comprising the step of: 

dividing the content data into blocks each of 
which is composed of a plurality of bits, 
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wherein the generating step is performed by 
generating an initial value using data of a first por- 
tion of each of the divided blocks. 

8. The encrypting method as set forth in claim 7, 

wherein the encrypting step is performed by 
encrypting each of the divided blocks correspond- 
ing to block encrypting system. 

9. The encrypting method as set forth in claim 6, 

wherein the initial value is encrypted. 

10. The encrypting method as set forth in claim 6, 

wherein the data of the first portion of the con- 
tent data is variable. 

11. A decrypting apparatus, comprising: 

decrypting means for decrypting data of a sec- 
ond portion of encrypted content data using an 
initial value that is data of a first portion of the 
encrypted content data, outputting the decrypt- 
ed data, and chain-decrypting data of portions 
other than the first portion and the second por- 
tion using the data of the second portion of the 
encrypted content data; and 
generating means for generating the data of the 
first portion using the data of the first portion of 
the encrypted content data. 

12. The decrypting apparatus as set forth in claim 11, 

wherein the content data has been encrypted 
in the unit of a block composed of a plurality of bits, 
and 

wherein the decrypting means decrypts the 
encrypted content data in the unit of a block. 

13. The decrypting apparatus as set forth in claim 12, 

wherein the generating means generates the 
data of the first portion using the data of the first 
portion of the encrypted content data in the unit of 
a block. 

14. The decrypting apparatus as set forth in claim 11 , 

wherein the initial value has been encrypted, 

and 

wherein the data of the first portion is gener- 
ated by decrypting the initial value. 

15. A decrypting method, comprising the steps of: 

decrypting data of a second portion of encrypt- 
ed content data using an initial value that is data 
of a first portion of the encrypted content data 
and outputting the decrypted data; 
chain-decrypting data of portions otherthan the 
first portion and the second portion using the 
data of the second portion of the encrypted con- 



tent data; and 

generating the data of the first portion using the 
data of the first portion of the encrypted content 
data. 

5 

16. The decrypting method as set forth in claim 15, 

wherein the content data has been encrypted 
in the unit of a block composed of a plurality of bits, 
and 

10 wherein the decrypting step is performed by 

decrypting the encrypted content data in the unit of 
a block. 

17. The decrypting method as set forth in claim 16, 

15 wherein the generating step is performed by 

generating the data of the first portion using the data 
of the first portion of the encrypted content data in 
the unit of a block. 

20 18. The decrypting method as set forth in claim 15, 

wherein the initial value has been encrypted, 

and 

wherein the data of the first portion is gener- 
ated by decrypting the initial value. 

25 

19. A storage medium for storing data encrypted corre- 
sponding to an encrypting method, comprising the 
steps of: 

30 generating an initial value using data of a first 

portion of content data; and 
encrypting data of a second portion of the con- 
tent data using the generated initial value, out- 
putting the encrypted data, and chain-encrypt- 
35 ing data of portions other than the first portion 

and the second portion of the content data us- 
ing the output encrypted data. 

20. An encrypting apparatus, comprising: 

40 

generating means for generating an initial value 
using data of a predetermined portion of a 
stream of content data; and 
encrypting means for encrypting the content 
^5 data using the generated initial value, output- 

ting the encrypted data, and chain-encrypting 
data of other portions of the content data using 
the output encrypted data. 

so 21. The encrypting apparatus as set forth in claim 20, 
further comprising: 

dividing means for dividing the content data into 
blocks each of which is composed of a plurality 
55 of bits, 

wherein the encrypting means encrypts the 
content data in the unit of a divided block corre- 
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sponding to block encrypting system. 

22. The encrypting apparatus as set forth in claim 20, 

wherein the initial value is generated using 
data contained in a header portion of the stream. 

23. The encrypting apparatus as set forth in claim 20, 

wherein the initial value is generated using 
time information contained in a header portion of the 
stream. 

24. The encrypting apparatus as set forth in claim 20, 

wherein the initial value is generated using in- 
formation that is unique for each content, the infor- 
mation being contained in a header portion of the 
stream. 

25. The encrypting apparatus as set forth in claim 20, 

wherein the initial value is generated using 
time information contained in a header portion of the 
stream and information that is unique for each con- 
tent, the information being contained in the header 
portion of the stream. 

26. The encrypting apparatus as set forth in claim 20, 

wherein the initial value is encrypted. 

27. The encrypting apparatus as set forth in claim 20, 

wherein the stream is an MPEG stream. 

28. The encrypting apparatus as set forth in claim 27, 

wherein the header is a pack header, a packet 
header, or a file header. 

29. An encrypting method, comprising the steps of: 

generating an initial value using data of a pre- 
determined portion of a stream of content data; 
and 

encrypting the content data using the generat- 
ed initial value, outputting the encrypted data, 
and chain-encrypting data of other portions of 
the content data using the output encrypted da- 
ta. 

30. The encrypting method as set forth in claim 29, fur- 
ther comprising the step of: 

dividing the content data into blocks each of 
which is composed of a plurality of bits, 

wherein the encrypting step is performed by 
encrypting the content data in the unit of a divided 
block corresponding to block encrypting system. 

31. The encrypting method as set forth in claim 29, 

wherein the initial value is generated using 
data contained in a header portion of the stream. 



32. The encrypting method as set forth in claim 29, 

wherein the initial value is generated using 
time information contained in a header portion of the 
stream. 

5 

33. The encrypting method as set forth in claim 29, 

wherein the initial value is generated using in- 
formation that is unique for each content, the infor- 
mation being contained in a header portion of the 
10 stream. 

34. The encrypting method as set forth in claim 29, 

wherein the initial value is generated using 
time information contained in a header portion of the 
15 stream and information that is unique for each con- 
tent, the information being contained in the header 
portion of the stream. 

35. The encrypting method as set forth in claim 29, 
20 wherein the initial value is encrypted. 

36. The encrypting method as set forth in claim 29, 

wherein the stream is an MPEG stream. 

25 37. The encrypting method as set forth in claim 36, 

wherein the header is a pack header, a packet 
header, or a file header. 

38. A decrypting apparatus, comprising: 

30 

generating means for generating an initial value 
using data of a predetermined portion of a 
stream of content data; and 
decrypting means for decrypting data of a first 
35 portion of encrypted content data using the in- 

itial value, outputting the decrypted data, and 
chain-decrypting data of a second portion that 
is different from the first portion using the data 
of the first portion of the encrypted content data. 

40 

39. The decrypting apparatus as set forth in claim 38, 

wherein the content data has been encrypted 
in the unit of a block composed of a plurality of bits, 
and 

^5 wherein the storing means decrypts the en- 

crypted content data in the unit of a block. 

40. The decrypting apparatus as set forth in claim 38, 

wherein the generating means generates the 
50 initial value using data contained in a header portion 
of the stream. 

41. The decrypting apparatus as set forth in claim 38, 

wherein the generating means generates the 
55 initial value using time information contained in a 
header portion of the stream. 

42. The decrypting apparatus as set forth in claim 38, 
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wherein the generating means generates the 
initial value using information unique for each con- 
tent, the information being contained in a header 
portion of the stream. 

43. The decrypting apparatus as set forth in claim 38, 
wherein the generating means generates the 
initial value using time information contained in a 
header portion of the stream and information that is 
unique for each content, the information being con- 
tained in the header portion of the stream. 



52. The decrypting method as set forth in claim 47, 

wherein the generating step is performed by 
generating the initial value using time information 
contained in a header portion of the stream and in- 
5 formation that is unique for each content, the infor- 
mation being contained in the header portion of the 
stream. 

53. The decrypting method as set forth in claim 47, 

10 wherein the generating step is performed by 

decrypting the encrypted initial value. 



44. The decrypting apparatus as set forth in claim 38, 

wherein the generating means decrypts the 
encrypted initial value. 

45. The decrypting apparatus as set forth in claim 38, 

wherein the stream is an MPEG stream. 



54. The decrypting method as set forth in claim 47, 

wherein the stream is an MPEG stream. 

55. The decrypting method as set forth in claim 54, 

wherein the header is a pack header, a packet 
header, or a file header. 



46. The decrypting apparatus as set forth in claim 45, 

wherein the header is a pack header, a packet 
header, or a file header. 

47. A decrypting method, comprising the steps of: 

generating an initial value using data of a pre- 
determined portion of a stream of content data; 
and 

decrypting data of a first portion of encrypted 
content data using the initial value and output- 
ting the decrypted data; and 
chain -decrypting data of a second portion that 
is different from the first portion using the data 
of the first portion of the encrypted content data. 

48. The decrypting method as set forth in claim 47, 

wherein the content data has been encrypted 
in the unit of a block composed of a plurality of bits, 
and 

wherein the storing step is performed by de- 
crypting the encrypted content data in the unit of a 
block. 



20 56. A storage medium for storing data decrypted corre- 
sponding to a decrypting method, comprising the 
steps of: 



generating an initial value using data of a pre- 
25 determined portion of a stream of content data; 

and 

decrypting data of a first portion of encrypted 
content data using the initial value and output- 
ting the decrypted data; and 
30 chain-decrypting data of a second portion that 

is different from the first portion using the data 
of the first portion of the encrypted content data. 



35 



49. The decrypting method as set forth in claim 47, 

wherein the generating step is performed by 45 
generating the initial value using data contained in 
a header portion of the stream. 



50. The decrypting method as set forth in claim 47, 

wherein the generating step is performed by 50 
generating the initial value using time information 
contained in a header portion of the stream. 

51. The decrypting method as set forth in claim 47, 

wherein the generating step is performed by 55 
generating the initial value using information unique 
for each content, the information being contained in 
a header portion of the stream. 
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